Is Gemini safe for work data? It depends on the account

#How Gemini handles your data

Consumer Gemini carries Google's own warning: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services, including machine-learning technologies." Keep Activity (formerly Gemini Apps Activity) is on by default for anyone 18 or over. While it is on, Google uses your chats to improve its services, including training its models, and a subset is read by trained reviewers. Reviewed chats, plus related data such as language, device type and location, are kept for up to three years, even if you delete your activity. Turning Keep Activity off, or using a temporary chat, stops future chats from being used for training, as long as you do not send feedback. It does not stop review altogether: Google keeps those chats for 72 hours and can still have them reviewed to protect its users and services. All of this is in the Gemini Apps Privacy Hub.

Gemini in Workspace is the version an organisation can actually govern. The Generative AI in Google Workspace Privacy Hub states that your content is not reviewed by humans or used for model training outside your domain without permission, and that the Gemini app on a work account falls under the Workspace agreement and the Cloud Data Processing Addendum. An administrator decides whether Gemini is on at all, whether it can use content from Gmail, Drive and other Workspace apps, and how long conversations are kept.

Three parts of Gemini follow rules of their own:

• Gemini Notebook (formerly NotebookLM). In Workspace, uploads, questions and answers are not reviewed by humans or used for training, and prompts and answers are not kept after the session. Files you add from Drive become copies stored outside Drive, and your organisation's sharing and data region settings do not apply to them. On a personal account, chats with your notebooks follow your Keep Activity setting, human review included.
• Gemini in Chrome reads the page content and address of the tab you share, plus any other tabs you add, and some of that content may not be visible to you. On a personal account, page content is logged to your Google account temporarily. In Workspace it is not reviewed or used for training outside your domain, but Google states that it does not yet fall under its ISO and SOC certifications. For now, Workspace users only get it when they are signed in to Chrome in the US with US English as the language.
• Gems are saved instructions, sometimes with files, that people reuse and share. Google Vault does not retain or export a Gem attached to a prompt. Google has announced that skills will replace Gems in 2027.

#Can your employer see your Gemini chats?

On a work or school account, yes, if your organisation has set it up. Google Vault, the eDiscovery tool in Workspace, can retain, hold, search and export the prompts you type into the Gemini app and the answers it gives. A hold or retention rule takes precedence over the admin's history setting and over your own deletions: a chat you delete disappears from your screen but stays searchable in Vault. Vault is included in Business Plus, in Enterprise and Frontline (both Standard and Plus) and in every Education edition. Business Starter and Business Standard do not include it.

Without Vault, the admin still decides how long Gemini app conversations are kept: 3, 18 or 36 months, with 18 as the default, or not at all, in which case Google holds chats for up to 72 hours. Conversations in the Gemini side panel of Gmail, Docs and Drive have their own retention setting, from 90 days to indefinitely. Audit logs show who used Gemini, when, in which app and for what kind of task, such as a conversation or a summary.

Vault does not reach everything. According to Google's list of supported data, it does not retain, hold, search or export Gems and media files attached to a prompt in the Gemini app, or media Gemini generates in its answers there.

Gemini conversations inside Workspace apps, such as the side panel in Gmail, Docs and Drive, used to be out of Vault's reach altogether. On 22 October 2026 Google announced that admins can now export them from Vault, filtered by user, organisational unit and date range, across Gmail, Drive, Docs, Sheets, Slides and Meet. This covers conversations held while conversation history was on. Retention rules and holds do not apply to them yet, so how long they last is set by the separate side panel retention setting. Checked 23 October 2026.

A personal Google account is outside all of this. Vault, audit logs and the history settings only reach accounts your organisation manages. That does not make a personal account private: the consumer terms apply, human review included. Our article on whether your admin can read your AI chats compares this with ChatGPT and Copilot and explains what the GDPR asks of an employer before looking.

#Five places where it goes wrong

1. Employees using the consumer app instead of the managed one. This is the main risk, and exactly what happened to the support agent above: she worked in a personal Google account, so everything she pasted fell under the consumer terms and none of the Workspace protections applied. The same split runs through ChatGPT and Claude; our comparison of free and business AI accounts puts them side by side.

2. Gemini reaching into Gmail, Docs and Drive. The feature that makes Gemini in Workspace useful ("summarise this thread", "find the contract in my Drive") also gives it a wide reach into company data. Gemini only retrieves content the user already has access to, but one question can pull together information from across a mailbox and a Drive, including files that were shared more widely than anyone remembers. Under Workspace terms that stays inside the organisation. It does mean sharing settings carry more weight: a file shared too widely can turn up in the answer of anyone who can open it.

3. Phone apps that stay connected with activity off. In June 2025 Google emailed Android users to say that from 7 July Gemini would help them use Phone, Messages, WhatsApp and Utilities whether Gemini Apps Activity was on or off. The access was on by default; users who did not want it had to disconnect each app themselves. Google's privacy hub still lists Phone, Messages, WhatsApp and Device assistance as available on Android whether Keep Activity is on or off. Gemini does not use those chats for training while the setting is off, but the access remains, and many users never noticed the change. Sources: Android Authority, 26 June 2025; Malwarebytes, July 2025.

4. Hidden instructions in an email Gemini summarises. In July 2025, a researcher reported to 0DIN, Mozilla's bug bounty programme for generative AI, that hidden text in an email (white, set to zero font size, wrapped in a fake <Admin> tag) could hijack Gemini's "summarise this email" feature in Gmail. When the recipient asked for a summary, Gemini followed the hidden instruction and added a fake security warning with an attacker's phone number. No link, no attachment. Google said it had seen no abuse in the wild and was rolling out countermeasures, but any incoming newsletter, ticket or CRM message can carry the same kind of hidden instruction. Sources: 0DIN, 10 July 2025; BleepingComputer, 13 July 2025.

5. Personal data in a prompt that did not need it. Even in a fully managed Workspace, the safest data is the data you never paste. To summarise a performance review, the prompt does not need the employee's date of birth and phone number. The model will happily accept them, and the more identifiable data flows through prompts, the more any future misconfiguration, export or access review has to cover.

#What it means under the GDPR

Putting identifiable personal data (a name with an account number, health information, a customer's financial details) into an AI service is processing under the GDPR. If that happens in the consumer Gemini app, there is no data processing agreement behind it, no retention the organisation controls and a documented possibility of human review. For a regulated organisation, that is difficult to defend. Fines can reach €20 million or 4% of global annual turnover, whichever is higher, and the liability rests with the organisation as controller. A breach that poses a risk to people's rights and freedoms has to be reported to the data protection regulator within 72 hours of the organisation becoming aware of it.

Regulators are already looking at how Google handles data in and around its AI. In September 2024, Ireland's Data Protection Commission opened an inquiry into whether Google should have carried out a data protection impact assessment before using EU personal data to develop its PaLM 2 model; by October 2026 it had not published a decision (DPC, 12 September 2024). In September 2025, France's CNIL fined Google €325 million for showing ads between emails in Gmail without consent and for placing advertising cookies at account creation without valid consent (CNIL, 1 September 2025). Neither case is about the Gemini app, but both show how closely consent and impact assessments around Google's products are watched.

Beyond fines, when a customer or employee learns that their details were typed into a consumer chatbot, that is a trust problem no settings page can repair.

#The Gemini settings that make a difference

On a personal account

1. Turn off Keep Activity, or use a temporary chat On gemini.google.com, click Activity, then On, and choose Turn off or Turn off and delete activity. Future chats are no longer used for training, although Google still keeps them for 72 hours. For a single sensitive question, a temporary chat works the same way without changing the setting.

2. Disconnect the apps you do not want Gemini to use In the Gemini app on your Android phone, tap Menu, then Customize (under More if you do not see it) and Connectors. Next to an app, tap More options and then Disconnect. Phone, Messages, WhatsApp and Device assistance stay available even with Keep Activity off, so this is the place to turn them off. They only appear in the Android app, not on gemini.google.com.

3. Shorten the auto-delete period Activity is deleted after 18 months by default. You can choose 3 or 36 months, or turn auto-delete off. Choose the shortest period that works, and remember it does not reach chats already selected for human review.

In Google Workspace: a checklist for admins

• Steer people to the work account. The single most effective control is that employees use Gemini with their managed account. In the Admin console, under Generative AI and then Gemini app, Service status decides who gets the Gemini app.
• Set conversation history. On the same page, Gemini conversation history keeps chats for 3, 18 or 36 months, or not at all. The side panel in Gmail, Docs and Drive has its own setting under Gemini for Workspace.
• Decide what Vault keeps. Check whether your edition includes Vault, and set a retention rule for the Gemini app that matches your policy. A hold keeps chats that users delete. Side panel conversations can be exported from Vault but not held, so their own retention setting is what counts.
• Know where the audit logs are. Under Reporting, Audit and investigation, Gemini for Workspace log events shows who used Gemini, when and where.
• Decide on Gemini Notebook and Gemini in Chrome separately. Gemini Notebook can be turned on or off per group in the Admin console; Gemini in Chrome can be turned off with the GeminiSettings policy in Chrome Enterprise.
• Keep data in Europe where you need to. From Business Standard up, Data Regions can store Gemini prompts and answers in Europe. Keeping the processing in Europe as well takes Enterprise Data Regions (part of Enterprise Plus, or an add-on) or Assured Controls. Gemini Notebook falls outside Data Regions. For stricter requirements, see our article on data sovereignty and AI prompts; client-side encryption keeps selected files out of Gemini's reach.
• Tell employees what you can see. Explain whether Vault keeps their Gemini chats, for how long and who can search them.

Checked in October 2026 against Google's Gemini Apps Privacy Hub, the Generative AI in Google Workspace Privacy Hub, the Vault documentation and the Workspace admin help. Menu names can differ by device and app version.

#Seeing what is in the prompt, while you type

Settings decide what Google may do with the data. They do not decide what an employee types, or which Gemini they type it into. No admin policy reaches the support agent who, on her own phone, pastes a customer's bank details into the consumer app. The same pattern runs through every AI tool; our overview of AI data leakage shows where else it happens.

BeeSensible checks text fields for personal data as you type, including the Gemini prompt box. The browser extension sends the text to BeeSensible's detection service in the EU, where it is analysed in memory and discarded after detection. When sensitive details appear in a prompt, they are highlighted in the text: yellow, or red for the most sensitive data. The user can mask the value with a placeholder or remove it before sending.

The content of messages is not kept. What happens to a highlight is up to the user, unless the organisation has set masking on paste or on send to On by default or Always on. With Keep context, the extension puts the real values back into the answer on the employee's screen, while Gemini only ever sees the placeholders.

For Gemini, this matters most just before a customer's IBAN, a patient's identifier or an employee's date of birth is sent. A highlight does not hold the message back, and it is no substitute for choosing the managed Workspace version over the consumer app. It shows the person typing what is in the prompt, while there is still time to change it.